I'm working with Azure DevOps and I'm curious about how to enforce certain steps, like a CVE scan, across all our organization's build pipelines. Is there a way to implement policies or best practices that ensure these requirements are met? I believe this question could apply broadly to other platforms as well.
2 Answers
One effective method is to use templated pipelines. Instead of letting teams create their own pipelines, they reference a central template that contains all the necessary steps. This way, only the templated pipeline has the pathway to production, keeping things standardized across the board.
In Azure DevOps, you can ensure mandatory steps by creating your own extension and publishing it within your organization. This feature is known as a pipeline decorator, which prevents teams from disabling essential steps. If you're using GitHub, it’s even simpler with what's called Required Workflows.
But how do you ensure everyone is actually using those templates?